How to know the source of a process in Linux?One way might be to enable SELinux and run it in permissive mode, but make it log everything that happens. That way you should be able to see in the according logs what has created the file.